There is no such thing as strong end to end encryption on a proprietary operating system no one but the provider can verify.
FBI used iPhone notification data to retrieve deleted Signal messages
301–310 of 322 posts
Re: FBI used iPhone notification data to retrieve deleted Signal messages
#302Re: FBI used iPhone notification data to retrieve deleted Signal messages
#303Earlier quoted context omitted.
Reminds me what Whatsapp if you set up a 2FA PIN, which forces you to type it about every week to check if you forgot it. So annoying.
Sorry, I really cannot tell if this is sarcasm or not. One of the TOTP apps had a periodic test that you still knew the paraphrase. It started frequent and then backed off to like once a month. There’s definitely a benefit even if it’s annoying.
That’s not sarcasm and it doesn’t allow any backup, it literally just to make sure you didn’t forget the PIN. It’s once a week, forever. It’s a good way to make sure people don’t activate 2FA.
https://faq.whatsapp.com/1278661612895630/
> WhatsApp will regularly ask you to enter your PIN as a reminder. As long as you don't reset the PIN, you will get a reminder once a week.
Re: FBI used iPhone notification data to retrieve deleted Signal messages
#304Earlier quoted context omitted.
XMPP and Matrix don't require a phone number and have fine mobile apps.
And there's a reason they've achieved precisely zero penetration amongst normies. A chat app is useless if your friends and family won't use it.
I've actually had good luck getting friends and family on Matrix, after they'd previously used either Facebook Messenger or Hangouts.
Re: FBI used iPhone notification data to retrieve deleted Signal messages
#305Putting on my user hat... "OK. Signal has forward secrecy. So messages are gone after I receive them. Great!" Oh, you didn't turn on disappearing messages? Oh, right, then forensic tools like Cellebrite can get them. You have to turn on disappearing messages. The default is off. Oh, you did turn on disappearing messages? We send the messages in notifications. So the OS can keep them. Turns out Apple was doing that. T…
If the encryption security isn’t a freaking pain in every ass in the Tri county area, it’s not secure.
That’s been my go-to and I’ve yet to see it not work.
Re: FBI used iPhone notification data to retrieve deleted Signal messages
#306Original article: FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database[0] 0. https://www.404media.co/fbi-extracts-suspects-deleted-signal...
That's unfortunately less informative if you aren't already one of their subscribers.
> That's unfortunately less informative if you aren't already one of their subscribers.
Subscribe! They're probably the best journalism org in western media right now. Of course, that's not always an option for everyone, but I hope HN readers with a few extra bucks will check them out.
Re: FBI used iPhone notification data to retrieve deleted Signal messages
#307"However, it appears the defendant did not have that setting enabled, which, in turn, seemingly allowed the system to store the content in the database." "[A]llowing the system to store the content in the database" where a third party, such as Apple or a government, can access it is the default Only a small minority of users know about settings and how to change them. The vast majority of users do not change default…
“Only a small minority of users know about settings and how to change them. The vast majority of users do not change default settings.” Even worse, whatever critical settings you may set as a sophisticated user will frequently be reset, or changed, or re-organized under different settings… And of course, set back to insecure defaults… With subsequent software updates. This is a regular occurrence with Firefox and pri…
Strictly speaking, any software that cannot easily and permanently disable forced updates is insecure.
So, I don't like auto-updating.
Re: FBI used iPhone notification data to retrieve deleted Signal messages
#308Earlier quoted context omitted.
I think one of the main issues is that end-to-end message encryption is a sham as long as backups are not encrypted. I could have good device security, but if the person I'm talking to does not use ADP, iMessage and WhatsApp messages get backed up with only at-rest encryption (I think Signal opts out of standard iOS backups) and possibly the same for backups of the iPhone notification database (which the article sugg…
Signal data is not backed up, they have a local backup solution and an in-app e2e cloud backup for $2/month.
The backup is free for text and something like 60 days of media. You only have to pay to backup all media.
Re: FBI used iPhone notification data to retrieve deleted Signal messages
#309Earlier quoted context omitted.
They do control the content on the notification. It's a bit odd to put the sensitive text in the notification only to recommend disabling it at the system level.
They do not. They send encrypted notifications. It’s the OS that stores them unencrypted. It’s the OS at fault here IMHO.
Signal does NOT send encrypted notification, they send a blank notification that act like a ping, the actual encrypted data is then fetched by the app itself.
Re: FBI used iPhone notification data to retrieve deleted Signal messages
#310Earlier quoted context omitted.
So in that case, the system has access to the plaintext, therefore the Alphabet boys have access to it as well. Unless, of course, you believe Apple isn't cooperating with them. Am I missing something here? Maybe I'm missing a subtle detail.
A system like the one in "my phone's operating system". Do you assume that "Alphabet boys" have access to all parts of all Android file systems of all the phones ever produced?
I'm sorry but I'm having a really hard time understanding what you're saying. The first sentence I cannot understand at all. As for the second sentence, I think you might be confused about my usage of the term "Alphabet boys", which is slang for the intelligence agencies: https://youtu.be/lLf84LPzlVc?t=61 it seems like you thought I was referring to Google's parent company.